Hot answers tagged

36

You can prevent Ghostery from selling your data by opting out of the Ghost Rank feature. The feature is opt-in, so if you didn't already opt in there is nothing you need to do. It is then safe for you to use. Using a clone of Ghostery which is identical in every aspect except not having the Ghost Rank feature would make no practical difference from running ...


30

Another plugin worth mentioning is Privacy Badger. It's fairly new, but from the EFF, to which I would trust not to do any bad stuff. It's also fairly intelligent since it's not using Blacklist which is always a race against tracker vendors, but uses an algorithm to determine what it should block. I'm using it and am pretty happy with it. The only downside ...


23

I actually think the Mozilla devs have been pretty smart with this. Historically, most PDF exploits have come from the rendering engine rather than the parsing side. Adobe got wise early to the fact that malformed structure and content would screw them, and put a lot of effort into making sure that their parsing engine was rock solid. If you look at some of ...


12

Exploits fall into roughly two distinct categories: those which break the semantic rules of the implementation language (buffer overflows, use-after-free, uncontrolled type casts...) and those which play "by the rules". Since the new PDF reader is written in Javascript, exploits from the first category ought to be extremely rare, because of the intrinsic ...


11

I install a plugin that allows me to click on any part of a page and it gives me the color of the clicked object For this to work, the plugin needs to register a click event handler and it needs to interact with the document object model of the current HTML page. HTML was originally designed to share scientific documents. And while we build complex web ...


11

A VST is just a DLL which exposes a specific interface. As such, it can contain arbitrary code, and can do anything that an EXE could do. Treat it as such. If you don't trust it, don't run it. Keep in mind that virus scanning will only protect you against known signatures, so something unknown or custom might still catch you out. Running the plugin through ...


8

WebRTC is a P2P technology and performs encryption end-to-end by default. No metadata on Mozilla's servers. Per session encryption, so Mozilla cannot decrypt. There may be some vulnerabilities with the technology (i.e. there are), but the design is supposed to address your questions on an architectural level.


7

Another plugin worth mentioning is Request Policy (Continued). It blocks all requests to domain other than the one shown in the address bar. Directly after installation, some common third party domains are whitelisted. It is probably harder to use than the other plugins, since many web pages do not work without adding some domains to the whitelist (e.g. the ...


7

My German is pretty rusty, but I'm pretty sure the article from Heise Security doesn't really say what the H-online article claims. Unter Opera erreicht man die Plugin-Verwaltung durch die Eingabe von opera:plugins in die Adressleiste. Beim Internet Explorer genügt das Deaktiveren der Plug-ins unter "Add-Ons verwalten" nicht. Wer den IE einsetzt, sollte ...


6

As suggested by bstpierre, you cannot protect yourself against malicious users since a plugin allows by definition to run arbitrary code. However, if you want to prevent the abuse case where an innocent user downloads a plugin which seems legit but is not, you can do some signature checking with asymmetric crypto to make sure that this does not happen. ...


5

According to my experience it works fine (copy/paste and modify and CP again). However i have change only the name of the field to test a path manipulation. And it was a success. You might have issue with your webapp.


4

You are right. There are really many ways for a website to store persistent data on you, even if you dont want them too. Evercookie by Samy Kamkar is an example of this. Quotede from the site of Evercookie it stores persistent data on you with the help of these storage mechanisms: Standard HTTP Cookies Local Shared Objects (Flash Cookies) ...


4

Actually, depending on the browser and plugins used, there are many ways for a website to store persistent information on users' computer. It's not cookies and cache anymore. Some of these new methods require user confirmation, some don't - it also varies by browser. Flash has Local Shared Objects, Silverlight has Isolated Storage, HTML5 itself gives Offline ...


4

Usually it is possible to modify the POST request by copy/pasting into a text editor. But not always, I find it will often cause problems when posting JSON. This process can also damage the content-type and content-size, although it usually fixes this for you (but it is unreliable). In general I find standalone proxies to be easier to use and more ...


4

Disabling the add-ons is not enough. CERT writes in one of its vulnerability notes: Disable the Java plug-in and Java Deployment Toolkit for Internet Explorer Disabling the Java plug-in for Internet Explorer is significantly more complicated than with other browsers. There are multiple ways for a web page to invoke a Java applet, and multiple ways ...


4

At first here is a small list of all abbreviations used when you explain WebRTC, so if you do not know one you can have a look there: https://hacks.mozilla.org/2013/07/webrtc-and-the-ocean-of-acronyms/ Summary Here a small summary. More detailed information below. connections are end-to-end-encrypted for DTLS and SRTP is used for encrypting ...


3

There are several vulnerabilities known in previous versions of Flash which allow to execute arbitrary program code. That means an exploitive website can do anything a program can do which doesn't require administrator privileges, and there are ways to get around that prompt ("privilege escalation"). Among the common exploits which websites like to install ...


3

PDF exploits are not exploiting the PDF file format. Instead, they are exploiting vulnerabilities found in the PDF reader. If a PDF files contains an exploit for Adobe's reader, opening the file using pdf.js will prevent the exploit from working. Assuming Mozilla is fixing the bugs in pdf.js on a regular basis, this can reduce the impact of PDF exploits. ...


3

Silverlight can actually access the local filesystem, depending on the permissions granted. It is subject to .NET security mechanisms, but if these are badly configured, it is possible to read a user's files, or even change them.


3

Since 6u10 Java applets have been able to store "muffins" (effectively cookies) using java.jnlp.PersistenceService. Also from the same release, Java applets can also open files through FileOpenService, FileSaveService and ExtendedService.


3

The basic problem is that the plugin model doesn't have a properly defined/granular authorization policy. In a lot of cases its all or nothing when it comes to certain pieces of information. Maybe the plugin needs to know the particular URL of the page you are on. Well that might require access to browsing history, etc. The other part of the problem is ...


2

Greasemonkey allows you to basically have a scriptable API into website/data/view manipulation using JavaScript. It is beneficial in IT security to use to automate some things or even to give yourself a more usable view for output you may be receiving You can't really mitigate anything GreaseMonkey does directly persay, but preventing automation of ...


2

I appreciate the way you are trying to protect your users; kudos. However, I also want to inject a small note of caution, so you know what you are getting into. The hardest part is not the cryptography (e.g., public-key signatures). The hardest part is the process for determining which plugins are considered legitimate. Are you going to act as a ...


2

Your searches must have missed the GitHub repo, which is highlighted on w3af.org. Examples are all there.


2

This is a pretty scary thing to be doing, as by definition, you are wanting to look at sensitive, user-submitted data on those computers. Sure, you might catch the occasional wrongdoer, but you're going to be capturing quite a lot of normal people's passwords, emails, etc. Which is probably opening a whole slew of liability to whoever owns the computer lab. ...


2

The real base question here is What can a malicious website do if it gains access to a run an application on your computer? Which further boils down to What can a malicious application do on your computer Which is pretty much whatever it wants within it's level of access. If it can elevate it's level of access even further it's no longer your ...


1

It is hard to tell without knowing which sites this is, but all of what this plugin claims should be doable by HTTPS already (maybe except for the "printable certificates" - whatever this is). Also ActiveX has a known history of insecurities because there are almost no limitations of what can be done by such plugins. Thus this sounds highly suspicious too ...


1

It can't hurt. ABP (and similar software) blocks known ad providers and patterns that look like ad providers. If one of them gets popped and starts serving up malware, ABP will save you. If the site you're on is the compromised one, ABP can't help (unless the compromise is to point at a compromised ad network that's already blocked... seems complicated). ...


1

Greasemonkey is a useful tool for influencing how a page behaves. From a secuirty perspective Greasemonkey isn't really a tool for auditing, its a tool for leveraging flaws. It can be helpful in leveraging client side trust vulnerabilities, but its not the only way. For instance if your application is performing data validation in JavaScript then ...



Only top voted, non community-wiki answers of a minimum length are eligible